Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Trouble with CloudFlare

blog.torproject.org

Post reply on HN
Print view View original

101–110 of 361 posts

Re: The Trouble with CloudFlare

#101

Post by tonfa »

ryandrake wrote: post #72
_Codemonkeyism wrote: post #62

Earlier quoted context omitted.

The main point I took away from the article, that from one exit node many users originate. Some users are spammer. They contaminate the exit node IP. CF blocks an IP for spam, but does not remove the block after some time (when the spammer moved on).

What will happen when IPv6 takes off and anyone can just go get a unique, random, throwaway IP address each day? Do "IP reputation" systems work in such a world?

I guess reputation will be based on /64, that's the most practical solution.

Re: The Trouble with CloudFlare

#102

Post by kristofferR »

angry-hacker wrote: post #97
kristofferR wrote: post #90

The main problem with CloudFlare is how dumb their "protection" is. It doesn't make sense at all to block Tor users from just accessing read-only content, like CloudFlare does today. Forms/login pages/comment boxes etc should be protected of course, and most people wouldn't have anything against solving a captcha for logging in, but preventing people from just reading stuff anonymously/securely is borderline evil fro…

Have you ever had problems with malicious botnets/spam targeting your site and they are all behind TOR? It's not really that simple. If an IP, or IP range, behaves badly - goodbye. It's a TOR problem to solve it, it's not the problem of web servers and also CloudFlare.

That's my whole point.

Feel free to require a captcha for the login form etc and other pages where botnets/spam can be a problem, but don't ban people from pages where they only have read-access anyway.

It's like preventing people from reading books just because a few authors write a lot of crappy/illegal stuff.

Sure - make it a little bit harder to "become an author" (by using a captcha), but don't make it harder to read stuff.

Re: The Trouble with CloudFlare

#103

Post by tomjen3 »

eastdakota wrote: post #75

Tor has acknowledged their "botnet problem" since at least 2013: https://research.torproject.org/techreports/botnet-tr-2013-1... That same paper walks through the challenges of dealing with it and doesn't find any satisfactory solutions. As I wrote in our post on the topic, there's a trade off between security, anonymity, and convenience. CloudFlare provides security to our customers. We believe in the importance of…

I don't use tor but I sometimes use a VPN which occasionally have the same problem. I don't tend to solve the capchas, I tend to use the back button - and I don't think I am alone.

You should take this into account as well, since your customers are presumably not interested in losing business.

Re: The Trouble with CloudFlare

#104

Post by nxzero »

bogomipz wrote: post #81

The trouble with Clouflare is that they receive disproportionate amount of attention on Hackernews. Sometimes HN feels like an extension of their marketing machine. I'm not so sure they every single blog post of their needs to be an item on HN. Anyway that's my .02 cents.

Do you use Tor?

Re: The Trouble with CloudFlare

#105

Post by cronjobber »

ryandrake wrote: post #72
_Codemonkeyism wrote: post #62

Earlier quoted context omitted.

The main point I took away from the article, that from one exit node many users originate. Some users are spammer. They contaminate the exit node IP. CF blocks an IP for spam, but does not remove the block after some time (when the spammer moved on).

What will happen when IPv6 takes off and anyone can just go get a unique, random, throwaway IP address each day? Do "IP reputation" systems work in such a world?

Maybe coalesce neighboring bad IPs and subnets into larger bad subnets.

Re: The Trouble with CloudFlare

#106

Post by tonfa »

Titanous wrote: post #58
nothrabannosir wrote: post #20

Earlier quoted context omitted.

This is where 3D Secure truly shines; instead of completely refusing a transaction, you can request the issuing bank (= bank of the card used to pay with) to accept the liability in case of fraud (normally, it's the merchant who has to give the money back). Usually the issuing bank will then request the customer for additional challenge, e.g. a 2FA token, a code in SMS, or just their birthday. Some don't even require…

3D Secure is a complete disaster. It encourages users to put ridiculously sensitive information like social security numbers and bank credentials into an iframe in the merchant site. This trains users to be phished.

Really depends on the bank, some of them have a decent 2fa system for 3d secure.

Re: The Trouble with CloudFlare

#107

Post by Spearchucker »

scurvy wrote: post #74
baldfat wrote: post #69

Earlier quoted context omitted.

> I know Tor doesn't want to be in the network regulation business, but .... That is exactly why there is a Tor. Tor is for enabling anonymous communication. Now deciding who can do what or why would limit use and that would limit its ability to anonymous communication.

It's not a binary thing. You can regulate out fraud, abuse, and DDoS attacks without harming the legitimate use cases. It's like selling alcohol (cigarettes, porn, gambling), but not to minors. You can say "it's OK for this crowd not OK for this crowd". Otherwise you'd probably claim that said regulation would go against the very thing that the merchant is trying to do: make as much money as possible.

"It's like selling alcohol (cigarettes, porn, gambling), but not to minors."

It's not like that at all, because selling to everyone other than minors requires identity. Sure, you just need to verify the subject is over 18, i.e. you don't need to know name, birth date or address. But you DO need to know identity to issue the token that provisions the token that proves an age > 18.

And that breaks Tor's raison d'être.

Re: The Trouble with CloudFlare

#108

Post by zzzcpan »

grey-area wrote: post #100
aeorgnoieang wrote: post #73

Earlier quoted context omitted.

I didn't spot anything worded immaturely. What specifically do you think could be more maturely worded?

Instead of addressing the very real problems with usage of Tor, they try to pick holes in the 94% figure from cloudflare (which isn't actually very important), and go on to cite a study by cherry picking stats: https://news.ycombinator.com/item?id=11405101 . They don't mention that it explicitly states something which backs up cloudflare's position: Tor exit nodes were far more likely to contain malicious requests an…

They are being defensive.

> Tor exit nodes were far more likely to contain malicious requests

They also were far more likely to issue requests in general. This data point has no meaning. But that's statistics for you :)

Re: The Trouble with CloudFlare

#109

Post by jcoffland »

AnthonyMouse wrote: post #83
scurvy wrote: post #60

Maybe I'm a cranky, old-school network operator, but this is a very cut and dry problem. Tor runs a network that is rife with abuse and fraud. Tor needs to clean up and police its network. If it doesn't, it will be put on blacklists and customers will take active measures to block traffic from it. This is no different than a network or AS that is spammer friendly, botnet friendly, carder friendly, etc. All of those n…

The main point of Tor is that nobody knows where the traffic comes from. Realize you're asking them to break their own service. Your premise seems to be that you can't be bothered to protect your networks so you want to put that responsibility on someone else. It's called intermediary liability and it's terrible because the intermediary has all the wrong incentives. You demand that the intermediary eliminate maliciou…

Google does this with Linode servers. I route my HTTP traffic through a proxy on a Linode server. Google blocks me all the time for no reason other than that some other IPs in my range are doing bad things. I've tried to contact Google about this but they could care less about a handful of users.

Re: The Trouble with CloudFlare

#110

Post by AnthonyMouse »

pfg wrote: post #45

> 5) A report by CloudFlare competitor Akamai found that the percentage of legitimate e-commerce traffic originating from Tor IP addresses is nearly identical to that originating from the Internet at large. (Specifically, Akamai found that the "conversion rate" of Tor IP addresses clicking on ads and performing commercial activity was "virtually equal" to that of non-Tor IP addresses). This point seems rather odd. I'…

> I'm not following the connection between a large percentage of Tor requests being malicious and the fact that Tor users have almost the same conversion rate.

The point is that blocking or de facto blocking an IP address which is shared by many different users just because one is malicious is costing CloudFlare's customers money.

Post reply on HN